CVE-2026-23475: spi: fix statistics allocation
In the Linux kernel, the following vulnerability has been resolved:
spi: fix statistics allocation
The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference.
Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres).
Affected Software
Event History
Frequently Asked Questions
What access and timing are required to trigger the fault?
The issue requires local access and low privileges. An attacker must access the affected SPI controller sysfs attributes during the interval after the controller is registered with driver core but before its per-CPU statistics are allocated.
What is the practical impact of exploitation?
Successful triggering can cause a NULL-pointer dereference, resulting in a denial of service. The CVSS vector indicates no confidentiality or integrity impact.
How can I determine whether a system is exposed?
Systems are exposed when affected SPI controllers are present and their sysfs attributes can be accessed during controller registration. The provided data does not identify specific kernel versions or configurations.